Ezequiel Leon

Detection & Response Security Engineer

New Jersey · New York City · U.S. Remote

Security telemetry,
turned into safer systems.

Security engineer with 3+ years in dedicated cybersecurity roles and 8+ years across enterprise IT and security. I investigate complex activity, build practical detections, harden Microsoft-centered environments, and automate controls that reduce operational risk.

Detection & responseIncident investigationEndpoint & identitySecurity automation

View technical artifacts Resume LinkedIn

01 SELECTED SECURITY WORK

Technical judgment,
shown in context.

Three representative cases show the security question, investigation or engineering method, and the control or decision left behind. Employer-sensitive details are intentionally sanitized.

01ENTERPRISE INCIDENT RESPONSE

The Boeing Company · 10,000+ endpoints

From alert to defensible incident decision

SplunkEndpoint telemetryNetwork forensics

Ownership

Lead investigator for assigned incident cases

Security question

Was the activity malicious, how far did it reach, and what action was justified by the available evidence?

Method

Correlated endpoint, identity, network, and vulnerability signals; investigated malware, compromised accounts, phishing, suspicious PowerShell, and network anomalies; documented findings; and briefed technical stakeholders on containment and resolution.

Result

Independently led 50+ documented incident cases and used investigation findings to improve Splunk correlation searches and behavioral detections.

02THREAT-LED DETECTION

OnMed · Notepad++ updater campaign

From public threat reporting to verified internal coverage

Microsoft SentinelKQLIOC analysis

Ownership

Owned the internal exposure assessment and preventive detection

Security question

Did a reported compromised updater path create real exposure inside the environment, or only a plausible external risk?

Method

Translated reported indicators and behavior into an exposure checklist, reviewed available endpoint and SIEM telemetry, assessed installed software, briefed technical stakeholders, coordinated preventive controls, and built a proactive Sentinel detection.

Result

Confirmed no vulnerable systems or evidence of compromise and left a repeatable detection in place for future coverage.

03IDENTITY AUTOMATION

OnMed · Microsoft cloud identity

Closing the gaps in offboarding access termination

Azure AutomationMicrosoft GraphPowerShell

Ownership

Owned the workflow redesign and automation implementation

Security question

How could offboarding reliably close active sessions, refresh tokens, group access, and cached credentials instead of relying on a fragile manual sequence?

Method

Rebuilt the workflow with Azure Automation and Microsoft Graph to disable accounts, revoke sessions and refresh tokens, remove group memberships, and address cached Windows credentials.

Result

Converted an incomplete manual process into a repeatable identity-control workflow with clearer ownership and more complete access termination.

SUPPORTING OUTCOMES

Additional results from identity, endpoint, and vulnerability engineering.

Entra ID Indicators of Exposure remediated

Closed identity risks involving legacy authentication, privileged access, MFA, and identity-risk controls after an 83% Purple Knight assessment.

40+

Critical findings closed within 90 days

Established vulnerability scanning and patch-management processes at Amilar Capital and drove documented critical findings through remediation.

150+

Windows and macOS endpoints administered

Operated Defender for Endpoint and Intune controls across web, network, application, removable media, and endpoint policy at OnMed.

02 TECHNICAL ARTIFACTS

SANITIZED FOR PUBLIC REVIEW

The thinking behind the outcome.

These artifacts expose the design choices, evidence flow, and failure handling behind representative security work. Names, thresholds, identifiers, and employer-specific logic have been removed or generalized.

ARTIFACT 01

DETECTION ENGINEERING

ILLUSTRATIVE DESIGN PATTERN

Behavioral correlation blueprint

Turn isolated telemetry into an evidence-backed review queue.

01Collect

Endpoint
Identity
Network

02Normalize

Entity
Time window
Action

03Correlate

Cross-source
Sequence
Rarity

04Decide

Review
Contain
Tune

cross-signal-detection-lab.splexecutable lab logic

index=portfolio_lab sourcetype IN
  ("lab:endpoint", "lab:identity", "lab:network")
| eval entity=lower(coalesce(user, account))
| bin _time span=15m
| stats max(endpoint_signal) as endpoint
        max(identity_signal) as identity
        max(network_signal) as network
        by entity, host, _time
| eval signal_count=endpoint+identity+network
| where endpoint=1 AND signal_count>=2
| eval severity=if(signal_count=3,"high","medium")

This original lab uses synthetic events and is separate from employer production logic. The complete query, data, expected result, and validation procedure are available below.

Download SPL Download test data Validation guide

DESIGN DECISIONS

Correlate by entity and time.
Give the analyst a coherent activity window instead of unrelated alerts.
Require evidence diversity.
Raise confidence when endpoint, identity, or network sources independently agree.
Preserve the pivot.
Keep the underlying actions available for validation and defensible containment.
Feed outcomes back.
Use confirmed cases, benign explanations, and missed context to tune coverage.

ARTIFACT 02

IDENTITY AUTOMATION

SANITIZED ARCHITECTURE

Offboarding access termination

Replace a fragile checklist with an orchestrated control.

TRIGGERApproved offboarding event

Validated identity and effective time

ORCHESTRATEAzure Automation

PowerShell runbook with bounded actions

ENFORCEMicrosoft Graph

Identity and access control actions

VERIFYControl evidence

Completion, exception, and retry state

CONTROL ACTIONS DELIVERED

Disable the user account
Revoke active sessions
Revoke refresh tokens
Remove group access
Address cached Windows credentials

FAILURE MODE REVIEW

Partial completion

Record each completed action and isolate the failed step for retry.

Stale or missing identity

Fail closed and route the exception for owner validation.

Privilege boundary

Separate orchestration from permissions and scope Graph access to required actions.

Unverifiable outcome

Treat missing evidence as incomplete rather than assuming success.

03 EXPERIENCE

From infrastructure ownership to enterprise detection and response.

Security and infrastructure experience across defense, healthcare technology, financial services, retail, and global distribution.

Open full LinkedIn profile ↗

OCT 2025 · JUL 2026OnMed, LLCSecurity Engineer

Helped establish detection and response capabilities for a healthcare technology company while owning hands-on work across alerts, endpoint and identity security, detection tuning, vulnerability management, automation, and technical response.

Defender XDR, Intune, Entra ID, Elastic Security
150+ Windows and macOS endpoints
23 Entra ID Indicators of Exposure remediated

MAR 2025 · AUG 2025Tilley DistributionCybersecurity Specialist

Served as the primary internal security resource for a global environment of approximately 400 to 700 endpoints, covering alert triage, investigations, vulnerability remediation, and managed security coordination.

SentinelOne, Sumo Logic, Tenable
Alert triage and incident investigation
Vulnerability scanning and dashboards

NOV 2022 · FEB 2025The Boeing CompanyCybersecurity Incident Response Analyst

Investigated security incidents at enterprise scale, independently leading assigned cases involving malware, compromised accounts, phishing, suspicious PowerShell, network anomalies, and vulnerability events.

50+ documented incident cases
10,000+ endpoint environment
Splunk correlation searches and behavioral detections

APR 2022 · OCT 2022Amilar CapitalSystems Administrator

Hardened identity and network infrastructure supporting Bloomberg Terminal-integrated financial systems, implemented MFA and least privilege, and initiated an Azure migration.

40+ critical findings remediated
MFA and least privilege
Hybrid identity and network hardening

APR 2021 · APR 2022PolestarIT Specialist · Contract

Led end-to-end technology readiness for more than 10 retail launches across North America, coordinating networks, endpoints, audiovisual systems, vendors, testing, and post-launch support.

10+ retail launches
Network and endpoint deployment
Cross-functional delivery

MAY 2018 · APR 2021ConcentricLifeIT Apprentice to IT Administrator

Progressed into ownership of Cisco Meraki networks, identity, endpoint protection, segmentation, and infrastructure security for approximately 100 to 300 users.

Cisco Meraki networks
Okta, MFA, Jamf imaging
Endpoint and infrastructure investigations

2020 · 2025Columbia University Cybersecurity Boot Camp

Teaching Assistant, part time. Supported cybersecurity professional education alongside full-time technical roles.

04 TECHNICAL STACK

USED IN PRACTICE

Tools applied to investigations, controls, and security operations.

Microsoft Defender XDRMicrosoft SentinelElastic SecuritySplunkSentinelOneSumo LogicMicrosoft Entra IDMicrosoft IntuneTenableKQLPowerShellPythonAzure AutomationMicrosoft GraphCisco MerakiWiresharkMITRE ATT&CK

EDUCATIONB.S. Computer Information SystemsCUNY Lehman College, 2018

PROFESSIONAL EDUCATIONCybersecurity Professional EducationColumbia University, 2020

CERTIFICATIONCisco Meraki Network OperatorCMNO

TEACHINGCybersecurity Boot CampColumbia University, 2020 to 2025

OPEN TO SECURITY ENGINEERING ROLES

Need a detection and response engineer who moves from signal to evidence to measurable improvement?

Email Ezequiel Connect on LinkedIn Download resume

Leon.eze@outlook.comLodi, New Jersey · NYC / tri-state / U.S. remote

Security telemetry,turned into safer systems.

Technical judgment,shown in context.

From alert to defensible incident decision

From public threat reporting to verified internal coverage

Closing the gaps in offboarding access termination

Entra ID Indicators of Exposure remediated

Critical findings closed within 90 days

Windows and macOS endpoints administered

The thinking behind the outcome.

Turn isolated telemetry into an evidence-backed review queue.

Replace a fragile checklist with an orchestrated control.

From infrastructure ownership to enterprise detection and response.

Tools applied to investigations, controls, and security operations.

Need a detection and response engineer who moves from signal to evidence to measurable improvement?

Security telemetry,
turned into safer systems.

Technical judgment,
shown in context.